netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-gqv6-f424-3g7h
GHSA-jj3x-6fjg-wcr7
GHSA-mxmg-v768-hh7w
GHSA-96p3-v9fq-xhx4
GHSA-5rv7-j5ch-7h56
GHSA-c895-393j-x8fr
GHSA-gc66-2jq6-66c6
GHSA-hxqp-3c5h-j6j8
GHSA-jm68-j5fq-xhw2
GHSA-mwp4-784j-f836
GHSA-q42w-3m49-jxcj
GHSA-rj5f-gcgp-6867
GHSA-rvqr-jw83-fp2r
GHSA-whw7-wrpx-m3gw
This commit is contained in:
advisory-database[bot]
2024-08-23 00:33:03 +00:00
parent 3f05e71289
commit c7b89260db
14 changed files with 497 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-gqv6-f424-3g7h/GHSA-gqv6-f424-3g7h.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gqv6-f424-3g7h",
"modified": "2024-02-16T09:30:25Z",
"modified": "2024-08-23T00:31:37Z",
"published": "2024-02-16T09:30:25Z",
"aliases": [
"CVE-2023-51931"
],
"details": "An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-16T09:15:08Z"
advisories/unreviewed/2024/03/GHSA-jj3x-6fjg-wcr7/GHSA-jj3x-6fjg-wcr7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jj3x-6fjg-wcr7",
"modified": "2024-03-14T06:32:00Z",
"modified": "2024-08-23T00:31:38Z",
"published": "2024-03-14T06:32:00Z",
"aliases": [
"CVE-2024-28390"
],
"details": "An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access Control.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T04:15:09Z"
advisories/unreviewed/2024/03/GHSA-mxmg-v768-hh7w/GHSA-mxmg-v768-hh7w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mxmg-v768-hh7w",
"modified": "2024-03-25T09:32:35Z",
"modified": "2024-08-23T00:31:38Z",
"published": "2024-03-25T09:32:35Z",
"aliases": [
"CVE-2024-30187"
],
"details": "Anope before 2.0.15 does not prevent resetting the password of a suspended account.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-25T08:15:36Z"
advisories/unreviewed/2024/04/GHSA-96p3-v9fq-xhx4/GHSA-96p3-v9fq-xhx4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-96p3-v9fq-xhx4",
"modified": "2024-04-15T18:30:51Z",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-04-15T18:30:51Z",
"aliases": [
"CVE-2024-22014"
],
"details": "An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbolic Link Follow to Arbitrary File Delete.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-61"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-15T18:15:10Z"
advisories/unreviewed/2024/08/GHSA-5rv7-j5ch-7h56/GHSA-5rv7-j5ch-7h56.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5rv7-j5ch-7h56",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-8081"
],
"details": "A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8081"
},
{
"type": "WEB",
"url": "https://github.com/ppp-src/ha/issues/6"
},
{
"type": "WEB",
"url": "https://itsourcecode.com"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.275563"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.275563"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.396110"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T22:15:05Z"
}
}
advisories/unreviewed/2024/08/GHSA-c895-393j-x8fr/GHSA-c895-393j-x8fr.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c895-393j-x8fr",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-8083"
],
"details": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /php-ocls/classes/Master.php?f=pay_order. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8083"
},
{
"type": "WEB",
"url": "https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Sqli.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.275564"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.275564"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.396315"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T22:15:05Z"
}
}
advisories/unreviewed/2024/08/GHSA-gc66-2jq6-66c6/GHSA-gc66-2jq6-66c6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gc66-2jq6-66c6",
"modified": "2024-08-22T18:31:22Z",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-22T18:31:22Z",
"aliases": [
"CVE-2024-45191"
],
"details": "An issue was discovered in Matrix libolm (aka Olm) through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is related to software that uses a lookup table for the SubWord step. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-208"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T16:15:10Z"
advisories/unreviewed/2024/08/GHSA-hxqp-3c5h-j6j8/GHSA-hxqp-3c5h-j6j8.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hxqp-3c5h-j6j8",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-38210"
],
"details": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38210"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38210"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T23:15:07Z"
}
}
advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jm68-j5fq-xhw2",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-38208"
],
"details": "Microsoft Edge for Android Spoofing Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38208"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38208"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T23:15:07Z"
}
}
advisories/unreviewed/2024/08/GHSA-mwp4-784j-f836/GHSA-mwp4-784j-f836.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mwp4-784j-f836",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-8087"
],
"details": "A vulnerability was found in SourceCodester E-Commerce System 1.0 and classified as critical. This issue affects some unknown processing of the file /ecommerce/popup_Item.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8087"
},
{
"type": "WEB",
"url": "https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20sql%20union%20injection.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.275567"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.275567"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.396321"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T23:15:08Z"
}
}
advisories/unreviewed/2024/08/GHSA-q42w-3m49-jxcj/GHSA-q42w-3m49-jxcj.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q42w-3m49-jxcj",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-38209"
],
"details": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38209"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38209"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T23:15:07Z"
}
}
advisories/unreviewed/2024/08/GHSA-rj5f-gcgp-6867/GHSA-rj5f-gcgp-6867.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rj5f-gcgp-6867",
"modified": "2024-08-23T00:31:39Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-8084"
],
"details": "A vulnerability, which was classified as problematic, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file /php-ocls/classes/SystemSettings.php?f=update_settings of the component Setting Handler. The manipulation of the argument System Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8084"
},
{
"type": "WEB",
"url": "https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Stored%20Cross-Site%20Scripting(XSS).md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.275565"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.275565"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.396318"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T22:15:06Z"
}
}
advisories/unreviewed/2024/08/GHSA-rvqr-jw83-fp2r/GHSA-rvqr-jw83-fp2r.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rvqr-jw83-fp2r",
"modified": "2024-08-23T00:31:40Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-8089"
],
"details": "A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/admin/products/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8089"
},
{
"type": "WEB",
"url": "https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20arbitrary%20file%20upload%20vulnerability.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.275568"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.275568"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.396324"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T00:15:08Z"
}
}
advisories/unreviewed/2024/08/GHSA-whw7-wrpx-m3gw/GHSA-whw7-wrpx-m3gw.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whw7-wrpx-m3gw",
"modified": "2024-08-23T00:31:40Z",
"published": "2024-08-23T00:31:39Z",
"aliases": [
"CVE-2024-8086"
],
"details": "A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ecommerce/admin/login.php of the component Admin Login. The manipulation of the argument user_email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8086"
},
{
"type": "WEB",
"url": "https://github.com/0xffaaa/cve/blob/main/ecommerce-Universal%20password%20bypasses%20login%20verification.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.275566"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.275566"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.396320"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T23:15:08Z"
}
}